This isn’t limited just to the / directory. I can also write to many other system locations within the container (/bin, /sbin, etc.). I’m also able to write to host mounted volumes from within the container regardless of the permissions there as well.

Am I misunderstanding something about how the “-u” option is supposed to work, or is this a bug?